865 matches found
[SECURITY] [DSA 5699-1] redmine security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5699-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 24, 2024 https://www.debian.org/security/faq -...
Debian dsa-5699 : redmine - security update
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5699 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5699-1 [email protected] https://www.debian.org/securit...
DSA-5699-1 redmine - security update
Bulletin has no description...
PT-2024-3982 · Unknown · Redmine Dmsf Plugin
Name of the Vulnerable Software and Affected Versions: Redmine DMSF Plugin versions prior to 3.1.4 Description: The issue is related to a path traversal vulnerability in the Redmine DMSF Plugin, which can be exploited by a remote attacker to gain read, modify, or delete access to files. This...
Exploit for Improper Restriction of Excessive Authentication Attempts in Netgate Pfsense_Plus
CVE-2023-27100 - pfSense Anti-brute force protection bypass...
redmine.aura.tools Cross Site Scripting vulnerability OBB-3918898
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
BIT-REDMINE-2020-36306
Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the backurl field...
BIT-REDMINE-2020-36307
Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links...
BIT-REDMINE-2020-36308
Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries...
BIT-REDMINE-2021-29274
Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip...
BIT-REDMINE-2021-30163
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to projectid values...
BIT-REDMINE-2021-30164
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the addissuenotes permission requirement by leveraging the Issues API...
BIT-REDMINE-2021-31863
Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read arbitrary local files accessible by the application server process...
BIT-REDMINE-2021-31864
Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the addissuenotes permission requirement by leveraging the incoming mail handler...
BIT-REDMINE-2021-31865
Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded attachments...
BIT-REDMINE-2021-31866
Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations within SysController and MailHandlerController...
BIT-REDMINE-2021-37156
Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated...
BIT-REDMINE-2021-42326
Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter...
BIT-REDMINE-2022-44030
Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configuration, this may require login as a registered user...